setup-openflow-privatelink

name	setup-openflow-privatelink
title	OpenFlow PrivateLink Setup
summary	Set up AWS PrivateLink between OpenFlow on SPCS and private data sources like RDS or on-prem databases.
description	Use when configuring private connectivity from Snowflake OpenFlow (running on SPCS) to AWS-hosted or on-premises data sources via AWS PrivateLink. Covers NLB + VPC Endpoint Service on AWS, then SYSTEM$PROVISION_PRIVATELINK_ENDPOINT, network rules, and External Access Integration on Snowflake. AWS only (Public Preview also exists on Azure but is out of scope here). Triggers: OpenFlow PrivateLink, SPCS private connectivity, NLB for OpenFlow, EAI for OpenFlow, SYSTEM$PROVISION_PRIVATELINK_ENDPOINT, OpenFlow RDS, OpenFlow MySQL, OpenFlow PostgreSQL, private ingestion OpenFlow, SPCS egress.
tools	["snowflake_sql_execute","Bash","Read","Write","Edit"]
prompt	Help me connect OpenFlow on SPCS to my private RDS MySQL instance using AWS PrivateLink.
language	en
status	Published
author	Snowflake Solutions Team
type	snowflake

Overview

Connect OpenFlow on SPCS to private data sources (RDS, on-prem DBs reachable via Direct Connect/VPN) through AWS PrivateLink. The flow:

OpenFlow (SPCS) → EAI → Network Rule (PRIVATE_HOST_PORT)
                  → Outbound PrivateLink Endpoint
                  → AWS VPC Endpoint Service → Internal NLB
                  → Target Group(s) → RDS / on-prem DB (via TCP proxy if needed)

Each NLB listener uses a unique port (any port > 1024) so multiple instances sharing the same backend port (e.g., two MySQL on 3306) can be disambiguated.

Prerequisites

• AWS permissions: NLB, target groups, endpoint services, security groups
• Snowflake ACCOUNTADMIN
• OpenFlow already deployed on SPCS
• One or more data sources in a private VPC (or on-prem with VPC connectivity)

Phase 1 — AWS infrastructure

1. Target groups (IP type) — one per database, TCP on the DB port, registered with the private IP of each instance (or a TCP proxy EC2 IP if the source is on-prem with non-RFC1918 addresses).
2. Internal NLB — TCP listeners on unique custom ports (e.g., 3301, 3302), each forwarding to its target group. Enable cross-zone load balancing. Set dns_record.client_routing_policy=any_availability_zone.
3. VPC Endpoint Service — fronts the NLB. Keep manual acceptance enabled (default).

⚠️ STOPPING POINT: Confirm describe-target-health shows healthy and the NLB state is active before continuing. Record nlb_dns_name, endpoint_service_name, and listener ports.

On-prem targets outside RFC1918/RFC6598 ranges require a single TCP proxy EC2 (NGINX/HAProxy/Envoy in TCP mode) registered into the target groups.

Phase 2 — Snowflake side

1. Get Snowflake's account principal:

   SELECT key, value FROM TABLE(FLATTEN(INPUT => PARSE_JSON(SYSTEM$GET_PRIVATELINK_CONFIG())));
   

   Add the privatelink-account-principal ARN to the endpoint service's allowed principals via aws ec2 modify-vpc-endpoint-service-permissions.

2. Provision the endpoint: